Trying to understand how SSL certificates work. Is the following correct:
I have a website at www.example.com and a mailserver at mail.example.com. The website is public and visited by many people. The mailserver is only for a small group of people all of whom I know.
I would like to add SSL to both the web and the mail server. As far as I understand, unless I buy a wildcard certificate, the certificate would only be valid for either www.example.com or mail.example.com, correct? I'd get a payed for SSL certificate from a reliable company and all my visitors to the web site would be happy.
To save some money, I was thinking of getting a free or self signed certificate for the mail server. As far as I understand on first access to the mail server our mail users would see a warning message of unknown certificate. But after it has been accepted once, by the mail users' computers, would there be any difference between this free certificate and a payed for certificate?
Somewhat related question. I currently set up example.com as alias for www.example.com in the apache conf. So if somebody accesses example.com (without "www"), the URL stays there and my certificate for www.example.com would not be valid, correct? So I'd have to add rewrite rules to change example.com to www.example.com, correct?